Privacy Policy

CardWatch (“we”, “us”) is the operator of the CardWatch web and Android application, available at https://cardwatchapp.com. For the purposes of the UK GDPR and EU GDPR, CardWatch is the data controller of any personal data you provide directly to us.

We deliberately collect as little as possible. In practice, that means:

• Account & settings — a unique user id, your chosen home currency, the reminder email address you type in Settings, and whether reminders are switched on.
• Credit-card metadata (manual entry) — nickname, issuer, the last four digits, statement balance, credit limit and due date. We never ask for or store full PANs, CVVs, expiry dates or PINs.
• Open banking data (Salt Edge) — if you choose to link a card via Salt Edge, we receive read-only account balances, currency and recent transactions. We do not receive your bank login credentials.
• Reminder logs — timestamps and the number of cards included in each reminder we send you, plus the Resend delivery id for audit.
• Basic product analytics — anonymised page views and interaction events to understand which features you actually use.

We do not sell, rent or share your personal or financial data with advertisers.

We use a small number of carefully-chosen sub-processors to run the app. Each one is bound by a data processing agreement and only receives the minimum data needed to do its job.

We only use your data to run CardWatch for you. The specific purposes are:

• Show your live balances, utilization and spending trend
• Send the payment-due reminder emails you asked for
• Enforce your plan limits (Free vs Pro card cap)
• Debug crashes and improve the app based on anonymised product analytics

Lawful basis under UK/EU GDPR: Contract (delivering the service you signed up for) and Legitimate interest (product analytics, security and fraud prevention).

Manual cards, settings and Salt Edge tokens are kept for as long as your account is active. When you delete a card, it is deleted from our database immediately. When you delete your account, we purge every piece of personal data linked to it within 30 days. Reminder-delivery logs are retained for 12 months for compliance and then automatically removed.

• TLS 1.3 on every connection between you and CardWatch
• AES-256 encryption at rest for all financial data
• Salt Edge connections are read-only and revocable in one click
• Least-privilege access — engineers never see your data unless you open a support ticket that requires it
• Regular dependency scanning and security patching of all backend components

Under UK/EU GDPR you have the right to:

• Ask us for a copy of the personal data we hold about you
• Ask us to correct anything that's wrong
• Ask us to delete your data (“right to be forgotten”)
• Withdraw consent or object to processing at any time
• Lodge a complaint with your local supervisory authority (the ICO in the UK)

To exercise any of these rights, email us at privacy@cardwatchapp.com. We'll respond within 30 days.

Questions about this policy or how your data is handled? Get in touch: